All,
I have just updated to SFOS 16.05.0 GA and now I am having issues with the IPS. If this is a bug I would like to roll back to SFOS 15 but it is no longer listed in the repository.
Could someone please tell me how to resolve this issue and/or roll back the latest version of SFOS 15 that was more stable than this new release.
Again, thanks for all responses.
The problem I am having is that I am seeing RST packets and drops and my connection is reflecting what my packet captures are showing.
How do I roll back to SW-SFMOS_15.01.0_MR-3-471 after upgrading to 16? It is no longer in my repository.
I am going to wait until the next release before I upgrade 16.
Hi Bobby,
Try a hard reboot and take SSH to XG and go to Advance Shell. Execute, service ips:restart -ds nosync.
Capture ips.log and kernel.log and post me the findings.
Thanks
IPS.log output*******
INFO[17143]:Jan 19 09:18:27:daq_pktq.c:459:InitPKTQ:msize 20000
INFO[17143]:Jan 19 09:18:27:daq_pktq.c:464:InitPKTQ:pkt_queue with nl_fd 7 device /dev/pktq0
[Jan 19 09:18:27 :17143]:Reload thread starting...
[Jan 19 09:18:27 :17143]:Reload thread started, thread 0x7f4c542ff700 (17144)
[Jan 19 09:18:27 :17143]:+--[HyperScan PCRE acceleration]------------------------------
[Jan 19 09:18:27 :17143]:| Hyperscan version : 4.2.0 2017-01-03
[Jan 19 09:18:27 :17143]:| Number of PCREs : 3163
[Jan 19 09:18:27 :17143]:| Total PCRE size : 910799 bytes
[Jan 19 09:18:27 :17143]:| Total Hyperscan size : 0 bytes
[Jan 19 09:18:27 :17143]:+-------------------------------------------------------------
[Jan 19 09:18:27 :17143]:
[Jan 19 09:18:27 :17143]: --== Initialization Complete ==--
[Jan 19 09:18:27 :17143]:
[Jan 19 09:18:27 :17143]: ,,_ -*> Snort! <*-
[Jan 19 09:18:27 :17143]: o" )~ Version 2.9.8.3 GRE (Build 383)
[Jan 19 09:18:27 :17143]: '''' By Martin Roesch & The Snort Team: www.snort.org/contact
[Jan 19 09:18:27 :17143]: Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
[Jan 19 09:18:27 :17143]: Copyright (C) 1998-2013 Sourcefire, Inc., et al.
[Jan 19 09:18:27 :17143]: Using libpcap version 1.6.2
[Jan 19 09:18:27 :17143]: Using PCRE version: 8.34 2013-12-15
[Jan 19 09:18:27 :17143]: Using ZLIB version: 1.2.8
[Jan 19 09:18:27 :17143]:
[Jan 19 09:18:27 :17143]: Rules Engine: SF_SNORT_DETECTION_ENGINE Version 2.6 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_SSLPP Version 1.1 <Build 4>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_SSH Version 1.1 <Build 3>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_SMTP Version 1.1 <Build 9>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_SIP Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_SDF Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_REPUTATION Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_POP Version 1.0 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_MODBUS Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_IMAP Version 1.0 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_GTP Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_FTPTELNET Version 1.2 <Build 13>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_DNS Version 1.1 <Build 4>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_DNP3 Version 1.1 <Build 1>
[Jan 19 09:18:27 :17143]: Preprocessor Object: SF_DCERPC2 Version 1.0 <Build 3>
[Jan 19 09:18:27 :17143]:Commencing packet processing (pid=17143)
[Jan 19 09:18:27 :17143]:Decoding Raw IP4
[Jan 19 09:18:27 :17010]:readfd cdata.cpipe[1] for pid 17143 set
[Jan 19 09:18:27 :17143]:Total preallocated memory : 2036.1094KB
[Jan 19 09:18:27 :17143]:Max memory alloc by webcat: 3732.1094KB
[Jan 19 09:18:27 :17010]:child 17143 dead
[Jan 19 09:18:27 :17010]:cdata[0].lstatus for pid 17143 set
[Jan 19 09:18:27 :17010]:1391:My childrens are dieing too fast
[Jan 19 09:18:27 :17010]:IPS: finally after all childrens grand father is going down
Snort exiting
fd 4 size 528384
size 1022 maxapp 4096 counter 7 bytesize 512
ERROR[17008]:Jan 19 09:18:27:s_worker.c:1160:csccom_loop:Snort master goes down: state: 1: exited, status=1
INFO[17008]:Jan 19 09:18:27:s_worker.c:1169:csccom_loop:on error
**************************************************************
syslog.log output
Jan 19 09:16:53 (none) user.info kernel: [39996.499952] traps: snort[16946] trap invalid opcode ip:677245 sp:7fff2d290898 error:0 in snort[400000+720000]
Jan 19 09:16:53 (none) user.info kernel: [39996.510867] :1752:pkt_vma_close:size 131072
Jan 19 09:16:53 (none) user.err kernel: [39996.510873] 825:appdev_vma_close:size 528384
Jan 19 09:16:53 (none) user.info kernel: [39996.510886] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:53 (none) user.info kernel: [39996.510887] :1483:pkt_container_down:container flags 0
Jan 19 09:16:53 (none) user.err kernel: [39996.521217] 817:appdev_vma_open:size 528384
Jan 19 09:16:53 (none) user.info kernel: [39996.521591] :1461:pkt_container_up:container flags 3
Jan 19 09:16:53 (none) user.info kernel: [39996.521594] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:53 (none) user.info kernel: [39996.521651] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:53 (none) user.info kernel: [39996.521653] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:53 (none) user.info kernel: [39996.521717] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:53 (none) user.info kernel: [39996.521782] :1724:pkt_vma_open:size 131072 range ffff880044120000:ffff880044140000
Jan 19 09:16:54 (none) user.info kernel: [39997.634906] traps: snort[16948] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:54 (none) user.info kernel: [39997.645816] :1752:pkt_vma_close:size 131072
Jan 19 09:16:54 (none) user.err kernel: [39997.645821] 825:appdev_vma_close:size 528384
Jan 19 09:16:54 (none) user.info kernel: [39997.645834] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:54 (none) user.info kernel: [39997.645836] :1483:pkt_container_down:container flags 0
Jan 19 09:16:54 (none) user.err kernel: [39997.656100] 817:appdev_vma_open:size 528384
Jan 19 09:16:54 (none) user.info kernel: [39997.656469] :1461:pkt_container_up:container flags 3
Jan 19 09:16:54 (none) user.info kernel: [39997.656471] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:54 (none) user.info kernel: [39997.656528] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:54 (none) user.info kernel: [39997.656530] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:54 (none) user.info kernel: [39997.656593] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:54 (none) user.info kernel: [39997.656660] :1724:pkt_vma_open:size 131072 range ffff8801024e0000:ffff880102500000
Jan 19 09:16:55 (none) user.info kernel: [39997.761365] traps: snort[16950] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:55 (none) user.info kernel: [39997.772301] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39997.772306] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39997.772320] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39997.772321] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.warn kernel: [39997.774692] net_ratelimit: 4 callbacks suppressed
Jan 19 09:16:55 (none) user.err kernel: [39997.774697] :819:__pkt_submit:pkt_container:100 not up so dropping packets(s)
Jan 19 09:16:55 (none) user.err kernel: [39997.774772] :819:__pkt_submit:pkt_container:100 not up so dropping packets(s)
Jan 19 09:16:55 (none) user.err kernel: [39997.782727] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39997.783110] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39997.783113] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39997.783173] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39997.783175] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39997.783240] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39997.783307] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:55 (none) user.info kernel: [39997.916028] traps: snort[16952] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:55 (none) user.info kernel: [39997.926937] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39997.926942] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39997.926956] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39997.926957] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39997.937230] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39997.937592] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39997.937594] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39997.937652] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39997.937654] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39997.937717] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39997.937783] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:55 (none) user.info kernel: [39998.045387] traps: snort[16954] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:55 (none) user.info kernel: [39998.056314] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.056319] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.056333] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.056334] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39998.066591] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.066955] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39998.066958] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.067016] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39998.067017] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39998.067080] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39998.067146] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:55 (none) user.info kernel: [39998.075107] traps: snort[16956] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:55 (none) user.info kernel: [39998.086086] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.086091] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.086104] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.086106] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39998.096410] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.096784] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39998.096787] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.096843] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39998.096845] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39998.096909] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39998.096975] :1724:pkt_vma_open:size 131072 range ffff8801024e0000:ffff880102500000
Jan 19 09:16:55 (none) user.info kernel: [39998.211203] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.211208] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.211222] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.211223] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39998.221446] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.221819] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39998.221821] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.221879] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39998.221881] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39998.221943] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39998.222010] :1724:pkt_vma_open:size 131072 range ffff8800447e0000:ffff880044800000
Jan 19 09:16:55 (none) user.info kernel: [39998.340548] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.340553] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.340567] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.340569] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39998.350896] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.351268] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39998.351271] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.351328] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39998.351329] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39998.351392] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39998.351458] :1724:pkt_vma_open:size 131072 range ffff8800447e0000:ffff880044800000
Jan 19 09:16:55 (none) user.info kernel: [39998.512965] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.512969] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.512984] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.512985] :1483:pkt_container_down:container flags 0
Jan 19 09:16:55 (none) user.err kernel: [39998.523318] 817:appdev_vma_open:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.523684] :1461:pkt_container_up:container flags 3
Jan 19 09:16:55 (none) user.info kernel: [39998.523686] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.523744] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:55 (none) user.info kernel: [39998.523746] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:55 (none) user.info kernel: [39998.523809] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:55 (none) user.info kernel: [39998.523877] :1724:pkt_vma_open:size 131072 range ffff8801024e0000:ffff880102500000
Jan 19 09:16:55 (none) user.info kernel: [39998.686478] :1752:pkt_vma_close:size 131072
Jan 19 09:16:55 (none) user.err kernel: [39998.686483] 825:appdev_vma_close:size 528384
Jan 19 09:16:55 (none) user.info kernel: [39998.686498] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:55 (none) user.info kernel: [39998.686499] :1483:pkt_container_down:container flags 0
Jan 19 09:16:56 (none) user.err kernel: [39998.696754] 817:appdev_vma_open:size 528384
Jan 19 09:16:56 (none) user.info kernel: [39998.697125] :1461:pkt_container_up:container flags 3
Jan 19 09:16:56 (none) user.info kernel: [39998.697127] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:56 (none) user.info kernel: [39998.697186] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:56 (none) user.info kernel: [39998.697188] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:56 (none) user.info kernel: [39998.697250] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:56 (none) user.info kernel: [39998.697317] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:56 (none) user.info kernel: [39998.779699] :1752:pkt_vma_close:size 131072
Jan 19 09:16:56 (none) user.err kernel: [39998.779704] 825:appdev_vma_close:size 528384
Jan 19 09:16:56 (none) user.info kernel: [39998.779718] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:56 (none) user.info kernel: [39998.779720] :1483:pkt_container_down:container flags 0
Jan 19 09:16:56 (none) user.err kernel: [39998.789951] 817:appdev_vma_open:size 528384
Jan 19 09:16:56 (none) user.info kernel: [39998.790313] :1461:pkt_container_up:container flags 3
Jan 19 09:16:56 (none) user.info kernel: [39998.790316] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:56 (none) user.info kernel: [39998.790373] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:56 (none) user.info kernel: [39998.790375] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:56 (none) user.info kernel: [39998.790442] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:56 (none) user.info kernel: [39998.790508] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:56 (none) user.info kernel: [39998.909008] :1752:pkt_vma_close:size 131072
Jan 19 09:16:56 (none) user.err kernel: [39998.909013] 825:appdev_vma_close:size 528384
Jan 19 09:16:56 (none) user.info kernel: [39998.909027] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:56 (none) user.info kernel: [39998.909028] :1483:pkt_container_down:container flags 0
Jan 19 09:16:56 (none) user.err kernel: [39998.919364] 817:appdev_vma_open:size 528384
Jan 19 09:16:56 (none) user.info kernel: [39998.919729] :1461:pkt_container_up:container flags 3
Jan 19 09:16:56 (none) user.info kernel: [39998.919731] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:56 (none) user.info kernel: [39998.919788] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:56 (none) user.info kernel: [39998.919790] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:56 (none) user.info kernel: [39998.919853] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:56 (none) user.info kernel: [39998.919920] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:57 (none) user.info kernel: [39999.887523] :1752:pkt_vma_close:size 131072
Jan 19 09:16:57 (none) user.err kernel: [39999.887528] 825:appdev_vma_close:size 528384
Jan 19 09:16:57 (none) user.info kernel: [39999.887543] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [39999.887544] :1483:pkt_container_down:container flags 0
Jan 19 09:16:57 (none) user.err kernel: [39999.897852] 817:appdev_vma_open:size 528384
Jan 19 09:16:57 (none) user.info kernel: [39999.898205] :1461:pkt_container_up:container flags 3
Jan 19 09:16:57 (none) user.info kernel: [39999.898207] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [39999.898265] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:57 (none) user.info kernel: [39999.898267] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:57 (none) user.info kernel: [39999.898328] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:57 (none) user.info kernel: [39999.898394] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:57 (none) user.info kernel: [39999.920663] :1752:pkt_vma_close:size 131072
Jan 19 09:16:57 (none) user.err kernel: [39999.920669] 825:appdev_vma_close:size 528384
Jan 19 09:16:57 (none) user.info kernel: [39999.920683] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [39999.920684] :1483:pkt_container_down:container flags 0
Jan 19 09:16:57 (none) user.err kernel: [39999.931027] 817:appdev_vma_open:size 528384
Jan 19 09:16:57 (none) user.info kernel: [39999.931390] :1461:pkt_container_up:container flags 3
Jan 19 09:16:57 (none) user.info kernel: [39999.931393] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [39999.931451] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:57 (none) user.info kernel: [39999.931453] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:57 (none) user.info kernel: [39999.931517] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:57 (none) user.info kernel: [39999.931583] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:57 (none) user.info kernel: [40000.049994] :1752:pkt_vma_close:size 131072
Jan 19 09:16:57 (none) user.err kernel: [40000.049999] 825:appdev_vma_close:size 528384
Jan 19 09:16:57 (none) user.info kernel: [40000.050013] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [40000.050015] :1483:pkt_container_down:container flags 0
Jan 19 09:16:57 (none) user.err kernel: [40000.060313] 817:appdev_vma_open:size 528384
Jan 19 09:16:57 (none) user.info kernel: [40000.060690] :1461:pkt_container_up:container flags 3
Jan 19 09:16:57 (none) user.info kernel: [40000.060692] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [40000.060750] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:57 (none) user.info kernel: [40000.060752] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:57 (none) user.info kernel: [40000.060816] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:57 (none) user.info kernel: [40000.060882] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:57 (none) user.warn kernel: [40000.325628] do_trap: 9 callbacks suppressed
Jan 19 09:16:57 (none) user.info kernel: [40000.325632] traps: snort[16976] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:57 (none) user.info kernel: [40000.336573] :1752:pkt_vma_close:size 131072
Jan 19 09:16:57 (none) user.err kernel: [40000.336578] 825:appdev_vma_close:size 528384
Jan 19 09:16:57 (none) user.info kernel: [40000.336592] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [40000.336594] :1483:pkt_container_down:container flags 0
Jan 19 09:16:57 (none) user.err kernel: [40000.346848] 817:appdev_vma_open:size 528384
Jan 19 09:16:57 (none) user.info kernel: [40000.347229] :1461:pkt_container_up:container flags 3
Jan 19 09:16:57 (none) user.info kernel: [40000.347232] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:57 (none) user.info kernel: [40000.347289] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:57 (none) user.info kernel: [40000.347291] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:57 (none) user.info kernel: [40000.347356] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:57 (none) user.info kernel: [40000.347423] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:58 (none) user.info kernel: [40000.827422] traps: snort[16978] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:58 (none) user.info kernel: [40000.838333] :1752:pkt_vma_close:size 131072
Jan 19 09:16:58 (none) user.err kernel: [40000.838338] 825:appdev_vma_close:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40000.838352] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40000.838353] :1483:pkt_container_down:container flags 0
Jan 19 09:16:58 (none) user.err kernel: [40000.848725] 817:appdev_vma_open:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40000.849093] :1461:pkt_container_up:container flags 3
Jan 19 09:16:58 (none) user.info kernel: [40000.849096] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40000.849154] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:58 (none) user.info kernel: [40000.849155] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:58 (none) user.info kernel: [40000.849217] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:58 (none) user.info kernel: [40000.849284] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:58 (none) user.info kernel: [40000.864821] traps: snort[16980] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:58 (none) user.info kernel: [40000.875773] :1752:pkt_vma_close:size 131072
Jan 19 09:16:58 (none) user.err kernel: [40000.875778] 825:appdev_vma_close:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40000.875792] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40000.875794] :1483:pkt_container_down:container flags 0
Jan 19 09:16:58 (none) user.err kernel: [40000.886620] 817:appdev_vma_open:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40000.886989] :1461:pkt_container_up:container flags 3
Jan 19 09:16:58 (none) user.info kernel: [40000.886992] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40000.887049] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:58 (none) user.info kernel: [40000.887051] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:58 (none) user.info kernel: [40000.887115] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:58 (none) user.info kernel: [40000.887182] :1724:pkt_vma_open:size 131072 range ffff880102600000:ffff880102620000
Jan 19 09:16:58 (none) user.info kernel: [40001.427790] traps: snort[16982] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:58 (none) user.info kernel: [40001.438752] :1752:pkt_vma_close:size 131072
Jan 19 09:16:58 (none) user.err kernel: [40001.438757] 825:appdev_vma_close:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40001.438771] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40001.438772] :1483:pkt_container_down:container flags 0
Jan 19 09:16:58 (none) user.err kernel: [40001.449148] 817:appdev_vma_open:size 528384
Jan 19 09:16:58 (none) user.info kernel: [40001.449512] :1461:pkt_container_up:container flags 3
Jan 19 09:16:58 (none) user.info kernel: [40001.449515] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:58 (none) user.info kernel: [40001.449572] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:58 (none) user.info kernel: [40001.449574] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:58 (none) user.info kernel: [40001.449638] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:58 (none) user.info kernel: [40001.449705] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.187587] traps: snort[16984] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.198506] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.198511] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.198525] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.198526] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.208790] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.209160] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.209163] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.209220] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.209222] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.209285] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.209352] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.278706] traps: snort[16986] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.289651] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.289656] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.289670] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.289671] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.299900] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.300263] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.300266] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.300321] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.300323] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.300386] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.300453] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.316984] traps: snort[16988] trap invalid opcode ip:677245 sp:7fff2d2907e8 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.327946] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.327952] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.327966] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.327968] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.338291] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.338662] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.338665] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.338722] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.338724] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.338786] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.338852] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.429988] traps: snort[16990] trap invalid opcode ip:7d0777 sp:7fff2d290640 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.440967] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.440972] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.440987] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.440989] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.441488] :819:__pkt_submit:pkt_container:100 not up so dropping packets(s)
Jan 19 09:16:59 (none) user.err kernel: [40002.442934] :819:__pkt_submit:pkt_container:100 not up so dropping packets(s)
Jan 19 09:16:59 (none) user.err kernel: [40002.448846] :819:__pkt_submit:pkt_container:100 not up so dropping packets(s)
Jan 19 09:16:59 (none) user.err kernel: [40002.451306] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.451681] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.451684] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.451741] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.451743] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.451807] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.451873] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.458756] traps: snort[16992] trap invalid opcode ip:677245 sp:7fff2d290a28 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.469489] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.469494] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.469507] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.469509] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.479864] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.480232] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.480235] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.480293] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.480294] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.480357] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.480423] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.505736] traps: snort[16994] trap invalid opcode ip:677245 sp:7fff2d290898 error:0 in snort[400000+720000]
Jan 19 09:16:59 (none) user.info kernel: [40002.516662] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.516667] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.516681] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.516683] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.526910] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.527278] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.527281] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.527338] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.527340] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.527403] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.527470] :1724:pkt_vma_open:size 131072 range ffff880102600000:ffff880102620000
Jan 19 09:16:59 (none) user.info kernel: [40002.594494] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.594499] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.594513] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.594514] :1483:pkt_container_down:container flags 0
Jan 19 09:16:59 (none) user.err kernel: [40002.606724] 817:appdev_vma_open:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.607121] :1461:pkt_container_up:container flags 3
Jan 19 09:16:59 (none) user.info kernel: [40002.607125] :1462:pkt_container_up:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.607185] :1497:pkt_ioctl:ioctl cont 0 cmd 2147765249 arg 259246632
Jan 19 09:16:59 (none) user.info kernel: [40002.607187] :1526:pkt_ioctl:container size 131072
Jan 19 09:16:59 (none) user.info kernel: [40002.607253] :1765:pkt_mmap:pkt_mmap: start
Jan 19 09:16:59 (none) user.info kernel: [40002.607320] :1724:pkt_vma_open:size 131072 range ffff8800447c0000:ffff8800447e0000
Jan 19 09:16:59 (none) user.info kernel: [40002.639847] :1752:pkt_vma_close:size 131072
Jan 19 09:16:59 (none) user.err kernel: [40002.639851] 825:appdev_vma_close:size 528384
Jan 19 09:16:59 (none) user.info kernel: [40002.639865] :1482:pkt_container_down:cntr 0 rcntr 0
Jan 19 09:16:59 (none) user.info kernel: [40002.639867] :1483:pkt_container_down:container flags 0
Jan 19 09:17:00 (none) user.err kernel: [40003.220113] 825:appdev_vma_close:size 528384
Jan 19 09:17:00 (none) user.err kernel: [40003.220149] 573:appdev_release:dev open 1
Jan 19 09:17:00 (none) user.err kernel: [40003.220151] 586:appdev_release:counter 7 size 1022
Jan 19 09:17:00 (none) user.err kernel: [40003.220153] 589:appdev_release:dev open 0
Jan 19 09:17:00 (none) user.err kernel: [40003.393542] nf_conntrack_pktq: unloaded
I guess the log is self explanatory. A little humor from the snort devs adds insult to injury but it is funny[:D] Is this an appliance? Probably opening a support case would be a good idea if you have support.BobbyDigital said:[Jan 19 09:18:27 :17010]:child 17143 dead[Jan 19 09:18:27 :17010]:cdata[0].lstatus for pid 17143 set
[Jan 19 09:18:27 :17010]:1391:My childrens are dieing too fast
[Jan 19 09:18:27 :17010]:IPS: finally after all childrens grand father is going down
As far as rolling back, you will probably have to bite the bullet and use the ISO. Also make sure that you have an older backup somewhere because v16 backup won't work with v15. I am not even sure if you had the older v15 update file, it would load correctly with v16.05 configuration. Sorry for your troubles.
sachingurung,
is their a way to roll back to 15 without doing a fresh install? I only have the .iso file and 15 is no longer in my repository.
Thanks
Hi sachingurung thanks for the feedback. Since everyone is not having the same problem, do you guys by any chance know what causes the problem? Is it hardware releated? Thanks.
Edit: Just researched NC-13377 [IPS] IPS dies on rollback from SFOS v16 Beta-5 to SFOS v16 Beta-3 and it was supposedly fixed and was only a problem on rollback?
BobbyDigital, Go to services and disable IPS. Some of the categorization that WINGc doesn't cover will be broken and obviously you won't have any protection that snort offers but your machine will be stable. V16 is definitely better than v15 even though in some cases the older version seemed to run more smothly.
Hi Bobby,
You will need to contact Support to roll back on the previous version 15.
Thanks
Thank you. I did a fresh install back to 15 and I have no issues. i will just wait until the next major release before upgrading.
Again, thank everyone for their responses.
Thank you. I did a fresh install back to 15 and I have no issues. i will just wait until the next major release before upgrading.
Again, thank everyone for their responses.
